Over the past decade, several security issues with Linux Random Number Generator (LRNG) on PCs and Androids have emerged. The main problem involves the process of entropy harvesting, particularly at boot time. An entropy source in the input pool of LRNG is not transferred into the non-blocking output pool if the entropy counter of the input pool is less than 192 bits out of 4098 bits. Because the entropy estimation of LRNG is highly conservative, the process may require more than one minute for starting the transfer. Furthermore, the design principle of the estimation algorithm is not only heuristic but also unclear. Recently, Google released an Internet of Things (IoT) operating system called Brillo based on the Linux kernel. We analyze the behavior of the random number generator in Brillo, which inherits that of LRNG. In the results, we identify two features that enable recovery of random numbers. With these features, we demonstrate that random numbers of 700 bytes at boot time can be recovered with the success probability of 90% by using time complexity for 5.20 × 2 40 trials. Therefore, the entropy of random numbers of 700 bytes is merely about 43 bits. Since the initial random numbers are supposed to be used for sensitive security parameters, such as stack canary and key derivation, our observation can be applied to practical attacks against cryptosystem.

No abstract

Abstract. When random numbers are needed, kernel level threads can use at least one of two random number generators (RNGs), called LRNG and MD5 PRNG. LRNG is a well-known cryptographic RNG accessed via /dev/(u)random and MD5 PRNG provides a function interface get_random_int(). While the /dev/(u)random has been investigated a lot, MD5 PRNG had been regarded as a less important one. In this paper, we demonstrate MD5 PRNG is vulnerable against a generic attack by searching entropy source in some embedded systems. In fact, once a random number is obtained, one can predict previous outputs of MD5 PRNG. Even though the RNG uses high resolution clock of microsecond unit as an entropy source, we can recover random number by reducing search space. We suggest a generic attack which the attacker just guesses entropy source at most 2 53 times. This attack can be done within 74 hours using parallel implementation with NVIDIA GeForce Titan X.

Key Words : random number generator(rng), sensor, entropy, cryptography ABSTRACT Random number generator(RNG) is essential in cryptographic applications. As recently a system using small devices such as IoT, Sensor Network, SmartHome appears, the lightweight cryptography suitable for this system is being developed. However due to resource limitations and difficulties in collecting the entropy, RNG designed for the desktop computer are hardly applicable to lightweight environment. In this paper, we propose a lightweight RNG to produce cryptographically strong random number using sensors. Our design uses a Hankel matrix, block cipher as the structure and sensors values as noise source. Futhermore, we implement the lightweight RNG in Arduino that is one of the most popular lightweight devices and estimate the entropy values of sensors and random number to demonstrate the effectiveness and the security of our design.

No abstract